From a7514ebec9ea6958689277ed3dd2e47871d6dda6 Mon Sep 17 00:00:00 2001
From: Endi Sukma Dewata <edewata@redhat.com>
Date: Thu, 26 Jul 2012 20:40:08 -0500
Subject: [PATCH] Moved REST services into separate URLs.

To support different access control configurations the
REST services have been moved out of /pki into several
URLs.

The certificate request submission service is now located
under /ee and it does not require authentication. The
configuration service is located under /installer and
it requires service-level authentication using PIN. The
remaining services are located under /agent and /admin.
They require realm authentication using client cert or
basic authentication and also require administrator or
agent access rights. Existing servlets are not affected
by this change.

Ticket #107, #259
---
 .../test/{CARestClient.java => CAClient.java}      | 35 ++++++-----
 .../src/com/netscape/cms/servlet/test/CATest.java  |  8 +--
 base/ca/shared/webapps/ca/WEB-INF/web.xml          | 70 ++++++++++++++++-----
 .../ca/CertificateAuthorityApplication.java        |  6 +-
 .../cms/servlet/test/ConfigurationTest.java        |  6 +-
 .../cert/AgentCertRequestResource.java}            | 21 +------
 .../servlet => certsrv}/cert/CertResource.java     |  4 +-
 .../certsrv/cert/EECertRequestResource.java        | 44 +++++++++++++
 .../certsrv/group/GroupMemberResource.java         |  2 +-
 .../com/netscape/certsrv/group/GroupResource.java  |  2 +-
 .../netscape/certsrv/user/UserCertResource.java    |  2 +-
 .../com/netscape/certsrv/user/UserResource.java    |  2 +-
 .../src/com/netscape/cms/client/cert/CertCLI.java  |  4 +-
 .../cert/{CertRestClient.java => CertClient.java}  | 17 ++---
 .../com/netscape/cms/client/group/GroupCLI.java    |  4 +-
 .../{GroupRestClient.java => GroupClient.java}     |  4 +-
 .../src/com/netscape/cms/client/user/UserCLI.java  |  4 +-
 .../user/{UserRestClient.java => UserClient.java}  |  4 +-
 .../servlet/admin/SystemCertificateResource.java   |  2 +-
 .../AgentCertRequestService.java}                  | 44 ++-----------
 .../cms/servlet/cert/CertResourceService.java      |  1 +
 .../cms/servlet/cert/EECertRequestService.java     | 72 ++++++++++++++++++++++
 .../cms/servlet/csadmin/CMSRestClient.java         |  3 +-
 ...ionRESTClient.java => ConfigurationClient.java} |  4 +-
 .../cms/servlet/csadmin/ConfigurationUtils.java    |  2 +-
 .../com/netscape/cms/servlet/key/KeyResource.java  |  2 +-
 .../cms/servlet/profile/ProfileResource.java       |  2 +-
 .../cms/servlet/request/KeyRequestResource.java    |  2 +-
 .../request/model/CertRequestInfoFactory.java      |  6 +-
 base/deploy/src/scriptlets/pkijython.py            |  4 +-
 base/kra/functional/drmclient.py                   | 18 +++---
 .../test/{DRMRestClient.java => DRMClient.java}    |  4 +-
 .../src/com/netscape/cms/servlet/test/DRMTest.java |  4 +-
 33 files changed, 263 insertions(+), 146 deletions(-)
 rename base/ca/functional/src/com/netscape/cms/servlet/test/{CARestClient.java => CAClient.java} (77%)
 rename base/common/src/com/netscape/{cms/servlet/request/CertRequestResource.java => certsrv/cert/AgentCertRequestResource.java} (84%)
 rename base/common/src/com/netscape/{cms/servlet => certsrv}/cert/CertResource.java (97%)
 create mode 100644 base/common/src/com/netscape/certsrv/cert/EECertRequestResource.java
 rename base/common/src/com/netscape/cms/client/cert/{CertRestClient.java => CertClient.java} (80%)
 rename base/common/src/com/netscape/cms/client/group/{GroupRestClient.java => GroupClient.java} (96%)
 rename base/common/src/com/netscape/cms/client/user/{UserRestClient.java => UserClient.java} (96%)
 rename base/common/src/com/netscape/cms/servlet/{request/CertRequestResourceService.java => cert/AgentCertRequestService.java} (81%)
 create mode 100644 base/common/src/com/netscape/cms/servlet/cert/EECertRequestService.java
 rename base/common/src/com/netscape/cms/servlet/csadmin/{ConfigurationRESTClient.java => ConfigurationClient.java} (91%)
 rename base/kra/functional/src/com/netscape/cms/servlet/test/{DRMRestClient.java => DRMClient.java} (97%)

diff --git a/base/ca/functional/src/com/netscape/cms/servlet/test/CARestClient.java b/base/ca/functional/src/com/netscape/cms/servlet/test/CAClient.java
similarity index 77%
rename from base/ca/functional/src/com/netscape/cms/servlet/test/CARestClient.java
rename to base/ca/functional/src/com/netscape/cms/servlet/test/CAClient.java
index 24ce212775b235b8079d7c7339d305e52051c82a..b39dd924f06a603809c854e7e8354dc4596ee0ff 100644
--- a/base/ca/functional/src/com/netscape/cms/servlet/test/CARestClient.java
+++ b/base/ca/functional/src/com/netscape/cms/servlet/test/CAClient.java
@@ -20,10 +20,12 @@ package com.netscape.cms.servlet.test;
 import java.net.URISyntaxException;
 import java.util.Collection;
 
+import com.netscape.certsrv.cert.AgentCertRequestResource;
+import com.netscape.certsrv.cert.CertResource;
+import com.netscape.certsrv.cert.EECertRequestResource;
 import com.netscape.certsrv.dbs.certdb.CertId;
 import com.netscape.certsrv.request.RequestId;
 import com.netscape.cms.client.cli.ClientConfig;
-import com.netscape.cms.servlet.cert.CertResource;
 import com.netscape.cms.servlet.cert.model.CertDataInfos;
 import com.netscape.cms.servlet.cert.model.CertSearchData;
 import com.netscape.cms.servlet.cert.model.CertificateData;
@@ -31,22 +33,23 @@ import com.netscape.cms.servlet.csadmin.CMSRestClient;
 import com.netscape.cms.servlet.profile.ProfileResource;
 import com.netscape.cms.servlet.profile.model.ProfileData;
 import com.netscape.cms.servlet.profile.model.ProfileDataInfos;
-import com.netscape.cms.servlet.request.CertRequestResource;
 import com.netscape.cms.servlet.request.model.AgentEnrollmentRequestData;
 import com.netscape.cms.servlet.request.model.CertRequestInfo;
 import com.netscape.cms.servlet.request.model.CertRequestInfos;
 import com.netscape.cms.servlet.request.model.EnrollmentRequestData;
 
-public class CARestClient extends CMSRestClient {
+public class CAClient extends CMSRestClient {
 
     private CertResource certClient;
-    private CertRequestResource certRequestClient;
+    private AgentCertRequestResource agentCertRequestClient;
+    private EECertRequestResource eeCertRequestClient;
     private ProfileResource profileClient;
 
-    public CARestClient(ClientConfig config) throws URISyntaxException {
+    public CAClient(ClientConfig config) throws URISyntaxException {
         super(config);
 
-        certRequestClient = createProxy(CertRequestResource.class);
+        agentCertRequestClient = createProxy(AgentCertRequestResource.class);
+        eeCertRequestClient = createProxy(EECertRequestResource.class);
         certClient = createProxy(CertResource.class);
         profileClient = createProxy(ProfileResource.class);
     }
@@ -54,7 +57,7 @@ public class CARestClient extends CMSRestClient {
     public Collection<CertRequestInfo> listRequests(String requestState, String requestType) {
         CertRequestInfos infos = null;
         Collection<CertRequestInfo> list = null;
-        infos = certRequestClient.listRequests(
+        infos = agentCertRequestClient.listRequests(
                 requestState, requestType, new RequestId(0), 100, 100, 10);
         list = infos.getRequests();
 
@@ -97,45 +100,45 @@ public class CARestClient extends CMSRestClient {
             return null;
         }
 
-        return certRequestClient.enrollCert(data);
+        return eeCertRequestClient.enrollCert(data);
     }
 
     public CertRequestInfo getRequest(RequestId id) {
         if (id == null) {
             return null;
         }
-        return certRequestClient.getRequestInfo(id);
+        return agentCertRequestClient.getRequestInfo(id);
     }
 
     public AgentEnrollmentRequestData reviewRequest(RequestId id) {
         if (id == null) {
             return null;
         }
-        return certRequestClient.reviewRequest(id);
+        return agentCertRequestClient.reviewRequest(id);
     }
 
     public void approveRequest(RequestId id, AgentEnrollmentRequestData data) {
-        certRequestClient.approveRequest(id, data);
+        agentCertRequestClient.approveRequest(id, data);
     }
 
     public void rejectRequest(RequestId id, AgentEnrollmentRequestData data) {
-        certRequestClient.rejectRequest(id, data);
+        agentCertRequestClient.rejectRequest(id, data);
     }
 
     public void cancelRequest(RequestId id, AgentEnrollmentRequestData data) {
-        certRequestClient.cancelRequest(id, data);
+        agentCertRequestClient.cancelRequest(id, data);
     }
 
     public void updateRequest(RequestId id, AgentEnrollmentRequestData data) {
-        certRequestClient.updateRequest(id, data);
+        agentCertRequestClient.updateRequest(id, data);
     }
 
     public void validateRequest(RequestId id, AgentEnrollmentRequestData data) {
-        certRequestClient.validateRequest(id, data);
+        agentCertRequestClient.validateRequest(id, data);
     }
 
     public void unassignRequest(RequestId id, AgentEnrollmentRequestData data) {
-        certRequestClient.unassignRequest(id, data);
+        agentCertRequestClient.unassignRequest(id, data);
     }
 
 }
diff --git a/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java b/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java
index 8fa4b9bb4fb9c3762e63f6500bbe1f24d433a8fb..e87451f253c9652909e08c307a6e46e395da8778 100644
--- a/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java
+++ b/base/ca/functional/src/com/netscape/cms/servlet/test/CATest.java
@@ -148,13 +148,13 @@ public class CATest {
             log("Exception in logging into token:" + e.toString());
         }
 
-        CARestClient client;
+        CAClient client;
         try {
             ClientConfig config = new ClientConfig();
             config.setServerURI(protocol + "://" + host + ":" + port + "/ca");
             config.setCertNickname(clientCertNickname);
 
-            client = new CARestClient(config);
+            client = new CAClient(config);
         } catch (Exception e) {
             e.printStackTrace();
             return;
@@ -275,7 +275,7 @@ public class CATest {
 
     }
 
-    private static void enrollAndApproveCertRequest(CARestClient client, EnrollmentRequestData data) {
+    private static void enrollAndApproveCertRequest(CAClient client, EnrollmentRequestData data) {
         CertRequestInfos reqInfo = null;
         try {
             reqInfo = client.enrollCertificate(data);
@@ -295,7 +295,7 @@ public class CATest {
         }
     }
 
-    private static void enrollCertRequest(CARestClient client, EnrollmentRequestData data) {
+    private static void enrollCertRequest(CAClient client, EnrollmentRequestData data) {
         CertRequestInfos reqInfo = null;
         try {
             reqInfo = client.enrollCertificate(data);
diff --git a/base/ca/shared/webapps/ca/WEB-INF/web.xml b/base/ca/shared/webapps/ca/WEB-INF/web.xml
index a5983a4619913d8a617dbd3ecd4ee5b9705a6717..c66bfe75ff182a19c4f20a952be8e7adffe27cd3 100644
--- a/base/ca/shared/webapps/ca/WEB-INF/web.xml
+++ b/base/ca/shared/webapps/ca/WEB-INF/web.xml
@@ -1821,17 +1821,14 @@
    </listener>
 
    <context-param>
-      <param-name>resteasy.servlet.mapping.prefix</param-name>
-      <param-value>/pki</param-value>
-   </context-param>
-
-   <context-param>
       <param-name>resteasy.resource.method-interceptors</param-name>
       <param-value>
          org.jboss.resteasy.core.ResourceMethodSecurityInterceptor
       </param-value>
    </context-param>
 
+   <!-- ==================== RESTEasy Configuration =============== -->
+
    <servlet>
       <servlet-name>Resteasy</servlet-name>
       <servlet-class>org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher</servlet-class>
@@ -1843,7 +1840,52 @@
    
    <servlet-mapping>
       <servlet-name>Resteasy</servlet-name>
-      <url-pattern>/pki/*</url-pattern>
+      <url-pattern>/admin/groups/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/admin/users/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/agent/certs/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/agent/certrequests/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/agent/config/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/agent/keys/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/agent/keyrequests/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/agent/profiles/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/ee/certrequests/*</url-pattern>
+   </servlet-mapping>
+
+   <servlet-mapping>
+      <servlet-name>Resteasy</servlet-name>
+      <url-pattern>/installer/*</url-pattern>
    </servlet-mapping>
    
    <servlet-mapping>
@@ -2384,14 +2426,14 @@
     <security-constraint>
         <web-resource-collection>
             <web-resource-name>REST Interface</web-resource-name>
-            <url-pattern>/pki/certs/*</url-pattern>
-            <url-pattern>/pki/certrequests/*</url-pattern>
-            <url-pattern>/pki/config/*</url-pattern>
-            <url-pattern>/pki/groups/*</url-pattern>
-            <url-pattern>/pki/keys/*</url-pattern>
-            <url-pattern>/pki/keyrequests/*</url-pattern>
-            <url-pattern>/pki/profiles/*</url-pattern>
-            <url-pattern>/pki/users/*</url-pattern>
+            <url-pattern>/admin/groups/*</url-pattern>
+            <url-pattern>/admin/users/*</url-pattern>
+            <url-pattern>/agent/certs/*</url-pattern>
+            <url-pattern>/agent/certrequests/*</url-pattern>
+            <url-pattern>/agent/config/*</url-pattern>
+            <url-pattern>/agent/keys/*</url-pattern>
+            <url-pattern>/agent/keyrequests/*</url-pattern>
+            <url-pattern>/agent/profiles/*</url-pattern>
         </web-resource-collection>
         <auth-constraint>
             <role-name>*</role-name>
diff --git a/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java b/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java
index d539bdb44ad6d13bc83e1676e0c4e9833b01e492..d73defef78a2e51031e0faac3114777cbb336947 100644
--- a/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java
+++ b/base/ca/src/com/netscape/ca/CertificateAuthorityApplication.java
@@ -11,10 +11,11 @@ import com.netscape.cms.servlet.admin.SystemCertificateResourceService;
 import com.netscape.cms.servlet.admin.UserCertResourceService;
 import com.netscape.cms.servlet.admin.UserResourceService;
 import com.netscape.cms.servlet.base.CMSException;
+import com.netscape.cms.servlet.cert.AgentCertRequestService;
 import com.netscape.cms.servlet.cert.CertResourceService;
+import com.netscape.cms.servlet.cert.EECertRequestService;
 import com.netscape.cms.servlet.csadmin.SystemConfigurationResourceService;
 import com.netscape.cms.servlet.profile.ProfileResourceService;
-import com.netscape.cms.servlet.request.CertRequestResourceService;
 
 public class CertificateAuthorityApplication extends Application {
     private Set<Object> singletons = new HashSet<Object>();
@@ -26,7 +27,8 @@ public class CertificateAuthorityApplication extends Application {
 
         // certs and requests
         classes.add(CertResourceService.class);
-        classes.add(CertRequestResourceService.class);
+        classes.add(AgentCertRequestService.class);
+        classes.add(EECertRequestService.class);
 
         // profile management
         classes.add(ProfileResourceService.class);
diff --git a/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java b/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java
index 67b67fca0604ea40cc2a06bad5174f354eab50b2..77d23d6269dff332663030a3dad85eda658bd64f 100644
--- a/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java
+++ b/base/common/functional/src/com/netscape/cms/servlet/test/ConfigurationTest.java
@@ -57,7 +57,7 @@ import org.mozilla.jss.pkix.primitive.SubjectPublicKeyInfo;
 import org.mozilla.jss.util.Password;
 
 import com.netscape.cms.client.cli.ClientConfig;
-import com.netscape.cms.servlet.csadmin.ConfigurationRESTClient;
+import com.netscape.cms.servlet.csadmin.ConfigurationClient;
 import com.netscape.cms.servlet.csadmin.model.CertData;
 import com.netscape.cms.servlet.csadmin.model.ConfigurationData;
 import com.netscape.cms.servlet.csadmin.model.ConfigurationResponseData;
@@ -184,12 +184,12 @@ public class ConfigurationTest {
             System.out.println("Exception in logging into token:" + e.toString());
         }
 
-        ConfigurationRESTClient client = null;
+        ConfigurationClient client = null;
         try {
             ClientConfig config = new ClientConfig();
             config.setServerURI(protocol + "://" + host + ":" + port + "/" + cstype);
 
-            client = new ConfigurationRESTClient(config);
+            client = new ConfigurationClient(config);
         } catch (URISyntaxException e1) {
             e1.printStackTrace();
             System.exit(1);
diff --git a/base/common/src/com/netscape/cms/servlet/request/CertRequestResource.java b/base/common/src/com/netscape/certsrv/cert/AgentCertRequestResource.java
similarity index 84%
rename from base/common/src/com/netscape/cms/servlet/request/CertRequestResource.java
rename to base/common/src/com/netscape/certsrv/cert/AgentCertRequestResource.java
index f350747388f6b83a7b54560ce9b57a9490b09c62..d0110e6bdcdc04ab457988cffe60e9e6f3f5d21c 100644
--- a/base/common/src/com/netscape/cms/servlet/request/CertRequestResource.java
+++ b/base/common/src/com/netscape/certsrv/cert/AgentCertRequestResource.java
@@ -15,7 +15,7 @@
 // (C) 2007 Red Hat, Inc.
 // All rights reserved.
 // --- END COPYRIGHT BLOCK ---
-package com.netscape.cms.servlet.request;
+package com.netscape.certsrv.cert;
 
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DefaultValue;
@@ -26,16 +26,14 @@ import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
 import javax.ws.rs.QueryParam;
 import javax.ws.rs.core.MediaType;
-import javax.ws.rs.core.MultivaluedMap;
 
 import com.netscape.certsrv.request.RequestId;
 import com.netscape.cms.servlet.request.model.AgentEnrollmentRequestData;
 import com.netscape.cms.servlet.request.model.CertRequestInfo;
 import com.netscape.cms.servlet.request.model.CertRequestInfos;
-import com.netscape.cms.servlet.request.model.EnrollmentRequestData;
 
-@Path("/certrequests")
-public interface CertRequestResource {
+@Path("/agent/certrequests")
+public interface AgentCertRequestResource {
 
     public static final int DEFAULT_START = 0;
     public static final int DEFAULT_PAGESIZE = 20;
@@ -67,19 +65,6 @@ public interface CertRequestResource {
     @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON, MediaType.TEXT_XML })
     public AgentEnrollmentRequestData reviewRequest(@PathParam("id") RequestId id);
 
-    // Enrollment - used to test integration with a browser
-    @POST
-    @Path("enroll")
-    @Produces({ MediaType.TEXT_XML })
-    @Consumes({ MediaType.APPLICATION_FORM_URLENCODED })
-    public CertRequestInfos enrollCert(MultivaluedMap<String, String> form);
-
-    @POST
-    @Path("enroll")
-    @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON, MediaType.TEXT_XML })
-    @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
-    public CertRequestInfos enrollCert(EnrollmentRequestData data);
-
     @POST
     @Path("{id}/approve")
     @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
diff --git a/base/common/src/com/netscape/cms/servlet/cert/CertResource.java b/base/common/src/com/netscape/certsrv/cert/CertResource.java
similarity index 97%
rename from base/common/src/com/netscape/cms/servlet/cert/CertResource.java
rename to base/common/src/com/netscape/certsrv/cert/CertResource.java
index 74e02c3ea9859a109e4c073922da2c6a9b64160b..a76fda65ffb0c6dcbeb73b9472891670b217eb17 100644
--- a/base/common/src/com/netscape/cms/servlet/cert/CertResource.java
+++ b/base/common/src/com/netscape/certsrv/cert/CertResource.java
@@ -1,4 +1,4 @@
-package com.netscape.cms.servlet.cert;
+package com.netscape.certsrv.cert;
 
 import javax.ws.rs.Consumes;
 import javax.ws.rs.DefaultValue;
@@ -18,7 +18,7 @@ import com.netscape.cms.servlet.cert.model.CertUnrevokeRequest;
 import com.netscape.cms.servlet.cert.model.CertificateData;
 import com.netscape.cms.servlet.request.model.CertRequestInfo;
 
-@Path("/certs")
+@Path("/agent/certs")
 public interface CertResource {
     public static final int DEFAULT_MAXTIME = 10;
     public static final int DEFAULT_MAXRESULTS = 100;
diff --git a/base/common/src/com/netscape/certsrv/cert/EECertRequestResource.java b/base/common/src/com/netscape/certsrv/cert/EECertRequestResource.java
new file mode 100644
index 0000000000000000000000000000000000000000..6c3c478d9982decb504b960b749b006dd76c9cda
--- /dev/null
+++ b/base/common/src/com/netscape/certsrv/cert/EECertRequestResource.java
@@ -0,0 +1,44 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2007 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package com.netscape.certsrv.cert;
+
+import javax.ws.rs.Consumes;
+import javax.ws.rs.POST;
+import javax.ws.rs.Path;
+import javax.ws.rs.Produces;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.MultivaluedMap;
+
+import com.netscape.cms.servlet.request.model.CertRequestInfos;
+import com.netscape.cms.servlet.request.model.EnrollmentRequestData;
+
+@Path("/ee/certrequests")
+public interface EECertRequestResource {
+
+    @POST
+    @Path("enroll")
+    @Produces({ MediaType.TEXT_XML })
+    @Consumes({ MediaType.APPLICATION_FORM_URLENCODED })
+    public CertRequestInfos enrollCert(MultivaluedMap<String, String> form);
+
+    @POST
+    @Path("enroll")
+    @Produces({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON, MediaType.TEXT_XML })
+    @Consumes({ MediaType.APPLICATION_XML, MediaType.APPLICATION_JSON })
+    public CertRequestInfos enrollCert(EnrollmentRequestData data);
+}
diff --git a/base/common/src/com/netscape/certsrv/group/GroupMemberResource.java b/base/common/src/com/netscape/certsrv/group/GroupMemberResource.java
index 51370f5731f4597ee0e42a318a116e37c1016a86..8a41e26f4bf56c8ff8f1895cb7e99c6045d3f2e9 100644
--- a/base/common/src/com/netscape/certsrv/group/GroupMemberResource.java
+++ b/base/common/src/com/netscape/certsrv/group/GroupMemberResource.java
@@ -34,7 +34,7 @@ import org.jboss.resteasy.annotations.ClientResponseType;
 /**
  * @author Endi S. Dewata
  */
-@Path("/groups/{groupID}/members")
+@Path("/admin/groups/{groupID}/members")
 public interface GroupMemberResource {
 
     @GET
diff --git a/base/common/src/com/netscape/certsrv/group/GroupResource.java b/base/common/src/com/netscape/certsrv/group/GroupResource.java
index 5889048ea6546c57b3b57c7afeaa865b1ee9f83b..d57cc6816b8977244e4b74627e0d001b6066d97f 100644
--- a/base/common/src/com/netscape/certsrv/group/GroupResource.java
+++ b/base/common/src/com/netscape/certsrv/group/GroupResource.java
@@ -34,7 +34,7 @@ import org.jboss.resteasy.annotations.ClientResponseType;
 /**
  * @author Endi S. Dewata
  */
-@Path("/groups")
+@Path("/admin/groups")
 public interface GroupResource {
 
     @GET
diff --git a/base/common/src/com/netscape/certsrv/user/UserCertResource.java b/base/common/src/com/netscape/certsrv/user/UserCertResource.java
index b9339bc33ec739af6cff1fa826cab9133c7d4149..61a510325a6d4e090b3e4082f96facae4f42a6c3 100644
--- a/base/common/src/com/netscape/certsrv/user/UserCertResource.java
+++ b/base/common/src/com/netscape/certsrv/user/UserCertResource.java
@@ -34,7 +34,7 @@ import org.jboss.resteasy.annotations.ClientResponseType;
 /**
  * @author Endi S. Dewata
  */
-@Path("/users/{userID}/certs")
+@Path("/admin/users/{userID}/certs")
 public interface UserCertResource {
 
     @GET
diff --git a/base/common/src/com/netscape/certsrv/user/UserResource.java b/base/common/src/com/netscape/certsrv/user/UserResource.java
index fae700bc32a72a633cf715fddd4b2927cc397d04..7294162c10798bea2b14ad37c9c69f25b77cc87f 100644
--- a/base/common/src/com/netscape/certsrv/user/UserResource.java
+++ b/base/common/src/com/netscape/certsrv/user/UserResource.java
@@ -34,7 +34,7 @@ import org.jboss.resteasy.annotations.ClientResponseType;
 /**
  * @author Endi S. Dewata
  */
-@Path("/users")
+@Path("/admin/users")
 public interface UserResource {
 
     @GET
diff --git a/base/common/src/com/netscape/cms/client/cert/CertCLI.java b/base/common/src/com/netscape/cms/client/cert/CertCLI.java
index 65dfa23e4834689cc416bf5fe79c3bb717a6b19a..47e735446494ccc7b4926046c6bb892ba132984c 100644
--- a/base/common/src/com/netscape/cms/client/cert/CertCLI.java
+++ b/base/common/src/com/netscape/cms/client/cert/CertCLI.java
@@ -35,7 +35,7 @@ import com.netscape.cms.servlet.request.model.CertRequestInfo;
 public class CertCLI extends CLI {
 
     public MainCLI parent;
-    public CertRestClient client;
+    public CertClient client;
 
     public CertCLI(MainCLI parent) {
         super("cert", "Certificate management commands");
@@ -73,7 +73,7 @@ public class CertCLI extends CLI {
 
     public void execute(String[] args) throws Exception {
 
-        client = new CertRestClient(parent.config);
+        client = new CertClient(parent.config);
         client.setVerbose(verbose);
 
         if (args.length == 0) {
diff --git a/base/common/src/com/netscape/cms/client/cert/CertRestClient.java b/base/common/src/com/netscape/cms/client/cert/CertClient.java
similarity index 80%
rename from base/common/src/com/netscape/cms/client/cert/CertRestClient.java
rename to base/common/src/com/netscape/cms/client/cert/CertClient.java
index 224c2fcfaf72553eec28a1c8cb6fc7aed2f1169b..4ca97911d24ba1595facaa487f6c7c377e0cceec 100644
--- a/base/common/src/com/netscape/cms/client/cert/CertRestClient.java
+++ b/base/common/src/com/netscape/cms/client/cert/CertClient.java
@@ -19,15 +19,16 @@ package com.netscape.cms.client.cert;
 
 import java.net.URISyntaxException;
 
+import com.netscape.certsrv.cert.AgentCertRequestResource;
+import com.netscape.certsrv.cert.CertResource;
+import com.netscape.certsrv.cert.EECertRequestResource;
 import com.netscape.certsrv.dbs.certdb.CertId;
 import com.netscape.cms.client.cli.ClientConfig;
-import com.netscape.cms.servlet.cert.CertResource;
 import com.netscape.cms.servlet.cert.model.CertDataInfos;
 import com.netscape.cms.servlet.cert.model.CertRevokeRequest;
 import com.netscape.cms.servlet.cert.model.CertUnrevokeRequest;
 import com.netscape.cms.servlet.cert.model.CertificateData;
 import com.netscape.cms.servlet.csadmin.CMSRestClient;
-import com.netscape.cms.servlet.request.CertRequestResource;
 import com.netscape.cms.servlet.request.model.CertRequestInfo;
 import com.netscape.cms.servlet.request.model.CertRequestInfos;
 import com.netscape.cms.servlet.request.model.EnrollmentRequestData;
@@ -35,16 +36,18 @@ import com.netscape.cms.servlet.request.model.EnrollmentRequestData;
 /**
  * @author Endi S. Dewata
  */
-public class CertRestClient extends CMSRestClient {
+public class CertClient extends CMSRestClient {
 
     public CertResource certClient;
-    public CertRequestResource certRequestResource;
+    public AgentCertRequestResource agentCertRequestClient;
+    public EECertRequestResource eeCertRequestClient;
 
-    public CertRestClient(ClientConfig config) throws URISyntaxException {
+    public CertClient(ClientConfig config) throws URISyntaxException {
         super(config);
 
         certClient = createProxy(CertResource.class);
-        certRequestResource = createProxy(CertRequestResource.class);
+        agentCertRequestClient = createProxy(AgentCertRequestResource.class);
+        eeCertRequestClient = createProxy(EECertRequestResource.class);
     }
 
     public CertificateData getCert(CertId id) {
@@ -71,6 +74,6 @@ public class CertRestClient extends CMSRestClient {
     }
 
     public CertRequestInfos enrollRequest(EnrollmentRequestData data){
-        return certRequestResource.enrollCert(data);
+        return eeCertRequestClient.enrollCert(data);
     }
 }
diff --git a/base/common/src/com/netscape/cms/client/group/GroupCLI.java b/base/common/src/com/netscape/cms/client/group/GroupCLI.java
index fefc1b0c99fa139060fbedc852818586eac8b5c4..b106c6fc114c4cebcb5e62e9b765f309a3de7208 100644
--- a/base/common/src/com/netscape/cms/client/group/GroupCLI.java
+++ b/base/common/src/com/netscape/cms/client/group/GroupCLI.java
@@ -34,7 +34,7 @@ import com.netscape.cms.client.cli.MainCLI;
 public class GroupCLI extends CLI {
 
     public MainCLI parent;
-    public GroupRestClient client;
+    public GroupClient client;
 
     public GroupCLI(MainCLI parent) {
         super("group", "Group management commands");
@@ -74,7 +74,7 @@ public class GroupCLI extends CLI {
 
     public void execute(String[] args) throws Exception {
 
-        client = new GroupRestClient(parent.config);
+        client = new GroupClient(parent.config);
         client.setVerbose(verbose);
 
         if (args.length == 0) {
diff --git a/base/common/src/com/netscape/cms/client/group/GroupRestClient.java b/base/common/src/com/netscape/cms/client/group/GroupClient.java
similarity index 96%
rename from base/common/src/com/netscape/cms/client/group/GroupRestClient.java
rename to base/common/src/com/netscape/cms/client/group/GroupClient.java
index 1b98035ea77d69a1de54e3b5337875e95fc37f56..429720768356a5edce355da6e3ce5ebc875f210c 100644
--- a/base/common/src/com/netscape/cms/client/group/GroupRestClient.java
+++ b/base/common/src/com/netscape/cms/client/group/GroupClient.java
@@ -33,12 +33,12 @@ import com.netscape.cms.servlet.csadmin.CMSRestClient;
 /**
  * @author Endi S. Dewata
  */
-public class GroupRestClient extends CMSRestClient {
+public class GroupClient extends CMSRestClient {
 
     public GroupResource groupClient;
     public GroupMemberResource groupMemberClient;
 
-    public GroupRestClient(ClientConfig config) throws URISyntaxException {
+    public GroupClient(ClientConfig config) throws URISyntaxException {
         super(config);
 
         groupClient = createProxy(GroupResource.class);
diff --git a/base/common/src/com/netscape/cms/client/user/UserCLI.java b/base/common/src/com/netscape/cms/client/user/UserCLI.java
index a5104135bba85493b22d0bc9321206ea20ffbafa..cc9bc8aa539efca07d25bedec700cff485c5f598 100644
--- a/base/common/src/com/netscape/cms/client/user/UserCLI.java
+++ b/base/common/src/com/netscape/cms/client/user/UserCLI.java
@@ -34,7 +34,7 @@ import com.netscape.cms.client.cli.MainCLI;
 public class UserCLI extends CLI {
 
     public MainCLI parent;
-    public UserRestClient client;
+    public UserClient client;
 
     public UserCLI(MainCLI parent) {
         super("user", "User management commands");
@@ -75,7 +75,7 @@ public class UserCLI extends CLI {
 
     public void execute(String[] args) throws Exception {
 
-        client = new UserRestClient(parent.config);
+        client = new UserClient(parent.config);
         client.setVerbose(verbose);
 
         if (args.length == 0) {
diff --git a/base/common/src/com/netscape/cms/client/user/UserRestClient.java b/base/common/src/com/netscape/cms/client/user/UserClient.java
similarity index 96%
rename from base/common/src/com/netscape/cms/client/user/UserRestClient.java
rename to base/common/src/com/netscape/cms/client/user/UserClient.java
index 54c1e3fa138af5c69cdc1e6c38b36a2b0562dee3..c4938b051193d866b1fd907e3b480ebc77e921e1 100644
--- a/base/common/src/com/netscape/cms/client/user/UserRestClient.java
+++ b/base/common/src/com/netscape/cms/client/user/UserClient.java
@@ -33,12 +33,12 @@ import com.netscape.cms.servlet.csadmin.CMSRestClient;
 /**
  * @author Endi S. Dewata
  */
-public class UserRestClient extends CMSRestClient {
+public class UserClient extends CMSRestClient {
 
     public UserResource userClient;
     public UserCertResource userCertClient;
 
-    public UserRestClient(ClientConfig config) throws URISyntaxException {
+    public UserClient(ClientConfig config) throws URISyntaxException {
         super(config);
 
         userClient = createProxy(UserResource.class);
diff --git a/base/common/src/com/netscape/cms/servlet/admin/SystemCertificateResource.java b/base/common/src/com/netscape/cms/servlet/admin/SystemCertificateResource.java
index d4cfcd296b34837b30c25362de2450a2970d2b69..eeadb2d12726d5a30b616386b7de3cedd4e604f4 100644
--- a/base/common/src/com/netscape/cms/servlet/admin/SystemCertificateResource.java
+++ b/base/common/src/com/netscape/cms/servlet/admin/SystemCertificateResource.java
@@ -10,7 +10,7 @@ import org.jboss.resteasy.annotations.ClientResponseType;
 
 import com.netscape.cms.servlet.cert.model.CertificateData;
 
-@Path("/config/cert")
+@Path("/agent/config/cert")
 public interface SystemCertificateResource {
 
     /**
diff --git a/base/common/src/com/netscape/cms/servlet/request/CertRequestResourceService.java b/base/common/src/com/netscape/cms/servlet/cert/AgentCertRequestService.java
similarity index 81%
rename from base/common/src/com/netscape/cms/servlet/request/CertRequestResourceService.java
rename to base/common/src/com/netscape/cms/servlet/cert/AgentCertRequestService.java
index 47f63ff6ce3798b29198dcd61b8c43d522eeb235..c02cc914e286b2ec63fcece6549c2916e8603b82 100644
--- a/base/common/src/com/netscape/cms/servlet/request/CertRequestResourceService.java
+++ b/base/common/src/com/netscape/cms/servlet/cert/AgentCertRequestService.java
@@ -16,17 +16,15 @@
 // All rights reserved.
 // --- END COPYRIGHT BLOCK ---
 
-package com.netscape.cms.servlet.request;
+package com.netscape.cms.servlet.cert;
 
 import javax.ws.rs.PathParam;
-import javax.ws.rs.core.MultivaluedMap;
 import javax.ws.rs.core.Response;
 
 import com.netscape.certsrv.apps.CMS;
-import com.netscape.certsrv.authentication.EAuthException;
-import com.netscape.certsrv.authorization.EAuthzException;
 import com.netscape.certsrv.base.BadRequestDataException;
 import com.netscape.certsrv.base.EBaseException;
+import com.netscape.certsrv.cert.AgentCertRequestResource;
 import com.netscape.certsrv.profile.EDeferException;
 import com.netscape.certsrv.profile.EProfileException;
 import com.netscape.certsrv.profile.ERejectException;
@@ -35,18 +33,17 @@ import com.netscape.certsrv.request.RequestId;
 import com.netscape.cms.servlet.base.BadRequestException;
 import com.netscape.cms.servlet.base.CMSException;
 import com.netscape.cms.servlet.base.CMSResourceService;
+import com.netscape.cms.servlet.request.RequestNotFoundException;
 import com.netscape.cms.servlet.request.model.AgentEnrollmentRequestData;
 import com.netscape.cms.servlet.request.model.CertRequestDAO;
 import com.netscape.cms.servlet.request.model.CertRequestInfo;
 import com.netscape.cms.servlet.request.model.CertRequestInfos;
-import com.netscape.cms.servlet.request.model.EnrollmentRequestData;
 import com.netscape.cmsutil.ldap.LDAPUtil;
 
 /**
  * @author alee
- *
  */
-public class CertRequestResourceService extends CMSResourceService implements CertRequestResource {
+public class AgentCertRequestService extends CMSResourceService implements AgentCertRequestResource {
 
     /**
      * Used to retrieve key request info for a specific request
@@ -72,37 +69,6 @@ public class CertRequestResourceService extends CMSResourceService implements Ce
         return info;
     }
 
-    // Enrollment - used to test integration with a browser
-    public CertRequestInfos enrollCert(MultivaluedMap<String, String> form) {
-        EnrollmentRequestData data = new EnrollmentRequestData(form);
-        return enrollCert(data);
-    }
-
-    public CertRequestInfos enrollCert(EnrollmentRequestData data) {
-        CertRequestInfos infos;
-        if (data == null) {
-            throw new BadRequestException("Bad data input into CertRequestResourceService.enrollCert!");
-        }
-        CertRequestDAO dao = new CertRequestDAO();
-
-        try {
-            infos = dao.submitRequest(data, servletRequest, uriInfo, getLocale());
-        } catch (EAuthException e) {
-            CMS.debug("enrollCert: authentication failed: " + e);
-            throw new CMSException(Response.Status.UNAUTHORIZED, e.toString());
-        } catch (EAuthzException e) {
-            CMS.debug("enrollCert: authorization failed: " + e);
-            throw new CMSException(Response.Status.UNAUTHORIZED, e.toString());
-        } catch (BadRequestDataException e) {
-            CMS.debug("enrollCert: bad request data: " + e);
-            throw new CMSException(Response.Status.BAD_REQUEST, e.toString());
-        } catch (EBaseException e) {
-            throw new CMSException(e.toString());
-        }
-
-        return infos;
-    }
-
     public void approveRequest(RequestId id, AgentEnrollmentRequestData data) {
         changeRequestState(id, data, "approve");
     }
@@ -201,7 +167,7 @@ public class CertRequestResourceService extends CMSResourceService implements Ce
 
         // get start marker
         if (start == null) {
-            start = new RequestId(CertRequestResource.DEFAULT_START);
+            start = new RequestId(AgentCertRequestResource.DEFAULT_START);
         }
 
         CertRequestDAO reqDAO = new CertRequestDAO();
diff --git a/base/common/src/com/netscape/cms/servlet/cert/CertResourceService.java b/base/common/src/com/netscape/cms/servlet/cert/CertResourceService.java
index 395907b5366d5baad567993d5e4d9ec078720ed4..25419c6a2e96791effcd870c47a057f98ed0d830 100644
--- a/base/common/src/com/netscape/cms/servlet/cert/CertResourceService.java
+++ b/base/common/src/com/netscape/cms/servlet/cert/CertResourceService.java
@@ -46,6 +46,7 @@ import com.netscape.certsrv.apps.CMS;
 import com.netscape.certsrv.base.EBaseException;
 import com.netscape.certsrv.base.ICertPrettyPrint;
 import com.netscape.certsrv.ca.ICertificateAuthority;
+import com.netscape.certsrv.cert.CertResource;
 import com.netscape.certsrv.dbs.EDBRecordNotFoundException;
 import com.netscape.certsrv.dbs.certdb.CertId;
 import com.netscape.certsrv.dbs.certdb.ICertRecord;
diff --git a/base/common/src/com/netscape/cms/servlet/cert/EECertRequestService.java b/base/common/src/com/netscape/cms/servlet/cert/EECertRequestService.java
new file mode 100644
index 0000000000000000000000000000000000000000..3addcbe2e73d3b1ec9c029ebffc4d60b5119d593
--- /dev/null
+++ b/base/common/src/com/netscape/cms/servlet/cert/EECertRequestService.java
@@ -0,0 +1,72 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2011 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+
+package com.netscape.cms.servlet.cert;
+
+import javax.ws.rs.core.MultivaluedMap;
+import javax.ws.rs.core.Response;
+
+import com.netscape.certsrv.apps.CMS;
+import com.netscape.certsrv.authentication.EAuthException;
+import com.netscape.certsrv.authorization.EAuthzException;
+import com.netscape.certsrv.base.BadRequestDataException;
+import com.netscape.certsrv.base.EBaseException;
+import com.netscape.certsrv.cert.EECertRequestResource;
+import com.netscape.cms.servlet.base.BadRequestException;
+import com.netscape.cms.servlet.base.CMSException;
+import com.netscape.cms.servlet.base.CMSResourceService;
+import com.netscape.cms.servlet.request.model.CertRequestDAO;
+import com.netscape.cms.servlet.request.model.CertRequestInfos;
+import com.netscape.cms.servlet.request.model.EnrollmentRequestData;
+
+/**
+ * @author alee
+ */
+public class EECertRequestService extends CMSResourceService implements EECertRequestResource {
+
+    // Enrollment - used to test integration with a browser
+    public CertRequestInfos enrollCert(MultivaluedMap<String, String> form) {
+        EnrollmentRequestData data = new EnrollmentRequestData(form);
+        return enrollCert(data);
+    }
+
+    public CertRequestInfos enrollCert(EnrollmentRequestData data) {
+        CertRequestInfos infos;
+        if (data == null) {
+            throw new BadRequestException("Bad data input into CertRequestResourceService.enrollCert!");
+        }
+        CertRequestDAO dao = new CertRequestDAO();
+
+        try {
+            infos = dao.submitRequest(data, servletRequest, uriInfo, getLocale());
+        } catch (EAuthException e) {
+            CMS.debug("enrollCert: authentication failed: " + e);
+            throw new CMSException(Response.Status.UNAUTHORIZED, e.toString());
+        } catch (EAuthzException e) {
+            CMS.debug("enrollCert: authorization failed: " + e);
+            throw new CMSException(Response.Status.UNAUTHORIZED, e.toString());
+        } catch (BadRequestDataException e) {
+            CMS.debug("enrollCert: bad request data: " + e);
+            throw new CMSException(Response.Status.BAD_REQUEST, e.toString());
+        } catch (EBaseException e) {
+            throw new CMSException(e.toString());
+        }
+
+        return infos;
+    }
+}
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java b/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java
index 2317eac47021c53ab89ddeac4e98aae7ddf3ed70..8eb80d25a44f9e27c02e81026e3d00a05ad17237 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/CMSRestClient.java
@@ -275,8 +275,7 @@ public abstract class CMSRestClient {
     }
 
     public <T> T createProxy(Class<T> clazz) throws URISyntaxException {
-        URI uri = new URI(config.getServerURI()+"/pki");
-        return ProxyFactory.create(clazz, uri, executor, providerFactory);
+        return ProxyFactory.create(clazz, config.getServerURI(), executor, providerFactory);
     }
 
     @SuppressWarnings("unchecked")
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationRESTClient.java b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationClient.java
similarity index 91%
rename from base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationRESTClient.java
rename to base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationClient.java
index 7fe8af2f334caeeb63b04a26690194261d9d1e54..7158454109a22a670aa5ec4b0f6fd8c28b6d8a1d 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationRESTClient.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationClient.java
@@ -30,11 +30,11 @@ import com.netscape.cms.servlet.csadmin.model.InstallTokenRequest;
  * @author alee
  *
  */
-public class ConfigurationRESTClient extends CMSRestClient {
+public class ConfigurationClient extends CMSRestClient {
 
     private SystemConfigurationResource configClient;
 
-    public ConfigurationRESTClient(ClientConfig config) throws URISyntaxException {
+    public ConfigurationClient(ClientConfig config) throws URISyntaxException {
         super(config);
 
         configClient = createProxy(SystemConfigurationResource.class);
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
index cc88084982fe40d5d3f53593c58cf7a744d0bb75..c6e33cb26914b7ab2f3e8f428a3488cd6c76419c 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
@@ -299,7 +299,7 @@ public class ConfigurationUtils {
         ClientConfig config = new ClientConfig();
         config.setServerURI("https://" + sdhost + ":" + sdport + "/ca");
 
-        ConfigurationRESTClient client = new ConfigurationRESTClient(config);
+        ConfigurationClient client = new ConfigurationClient(config);
 
         InstallToken token = client.getInstallToken(data);
 
diff --git a/base/common/src/com/netscape/cms/servlet/key/KeyResource.java b/base/common/src/com/netscape/cms/servlet/key/KeyResource.java
index 9a9b5db1a9aafb412fe5f4b1444defdf09c2d6fe..cba7cd1b6b0a34d21232351a1e3b640eff5095d3 100644
--- a/base/common/src/com/netscape/cms/servlet/key/KeyResource.java
+++ b/base/common/src/com/netscape/cms/servlet/key/KeyResource.java
@@ -14,7 +14,7 @@ import com.netscape.cms.servlet.key.model.KeyData;
 import com.netscape.cms.servlet.key.model.KeyDataInfos;
 import com.netscape.cms.servlet.request.model.RecoveryRequestData;
 
-@Path("/keys")
+@Path("/agent/keys")
 public interface KeyResource {
 
     public static final int DEFAULT_MAXTIME = 10;
diff --git a/base/common/src/com/netscape/cms/servlet/profile/ProfileResource.java b/base/common/src/com/netscape/cms/servlet/profile/ProfileResource.java
index e402aeadd39315ec1d78923df976796d131cc510..a2768980cb70c4d283c284d6b072cd469f7db31f 100644
--- a/base/common/src/com/netscape/cms/servlet/profile/ProfileResource.java
+++ b/base/common/src/com/netscape/cms/servlet/profile/ProfileResource.java
@@ -9,7 +9,7 @@ import javax.ws.rs.core.MediaType;
 import com.netscape.cms.servlet.profile.model.ProfileData;
 import com.netscape.cms.servlet.profile.model.ProfileDataInfos;
 
-@Path("/profiles")
+@Path("/agent/profiles")
 public interface ProfileResource {
 
     @GET
diff --git a/base/common/src/com/netscape/cms/servlet/request/KeyRequestResource.java b/base/common/src/com/netscape/cms/servlet/request/KeyRequestResource.java
index cf326540daf6212baa071b2906282be44182c5ae..91cdbbc9f14ff49d8e3d5f1ca2d9abe9fe766b9e 100644
--- a/base/common/src/com/netscape/cms/servlet/request/KeyRequestResource.java
+++ b/base/common/src/com/netscape/cms/servlet/request/KeyRequestResource.java
@@ -17,7 +17,7 @@ import com.netscape.cms.servlet.request.model.KeyRequestInfo;
 import com.netscape.cms.servlet.request.model.KeyRequestInfos;
 import com.netscape.cms.servlet.request.model.RecoveryRequestData;
 
-@Path("/keyrequests")
+@Path("/agent/keyrequests")
 public interface KeyRequestResource {
     public final String SYMMETRIC_KEY_TYPE = "symmetricKey";
     public final String PASS_PHRASE_TYPE = "passPhrase";
diff --git a/base/common/src/com/netscape/cms/servlet/request/model/CertRequestInfoFactory.java b/base/common/src/com/netscape/cms/servlet/request/model/CertRequestInfoFactory.java
index c21ea35c9a2948d722f29064d2e0317786c6c8de..822cd03c56f122335894c3e8a5310d950c5a40bb 100644
--- a/base/common/src/com/netscape/cms/servlet/request/model/CertRequestInfoFactory.java
+++ b/base/common/src/com/netscape/cms/servlet/request/model/CertRequestInfoFactory.java
@@ -28,12 +28,12 @@ import netscape.security.x509.X509CertImpl;
 
 import org.apache.commons.lang.StringUtils;
 
+import com.netscape.certsrv.cert.AgentCertRequestResource;
+import com.netscape.certsrv.cert.CertResource;
 import com.netscape.certsrv.profile.IEnrollProfile;
 import com.netscape.certsrv.request.IRequest;
 import com.netscape.certsrv.request.RequestId;
 import com.netscape.certsrv.request.RequestStatus;
-import com.netscape.cms.servlet.cert.CertResource;
-import com.netscape.cms.servlet.request.CertRequestResource;
 
 public class CertRequestInfoFactory {
 
@@ -49,7 +49,7 @@ public class CertRequestInfoFactory {
 
         info.setCertRequestType(request.getExtDataInString("cert_request_type"));
 
-        Path certRequestPath = CertRequestResource.class.getAnnotation(Path.class);
+        Path certRequestPath = AgentCertRequestResource.class.getAnnotation(Path.class);
         RequestId requestId = request.getRequestId();
 
         UriBuilder reqBuilder = uriInfo.getBaseUriBuilder();
diff --git a/base/deploy/src/scriptlets/pkijython.py b/base/deploy/src/scriptlets/pkijython.py
index ffd8884cde6f46db8a2efe0808cd283f585e9f15..dbfcbd268887fede4f23391254d2d47896196ef2 100644
--- a/base/deploy/src/scriptlets/pkijython.py
+++ b/base/deploy/src/scriptlets/pkijython.py
@@ -140,7 +140,7 @@ from org.mozilla.jss.util import Password
 
 
 # PKI Java Imports
-from com.netscape.cms.servlet.csadmin import ConfigurationRESTClient
+from com.netscape.cms.servlet.csadmin import ConfigurationClient
 from com.netscape.cms.servlet.csadmin.model import CertData
 from com.netscape.cms.servlet.csadmin.model import ConfigurationData
 from com.netscape.cms.servlet.csadmin.model import ConfigurationResponseData
@@ -279,7 +279,7 @@ class rest_client:
                        log.PKI_JYTHON_INITIALIZING_REST_CLIENT,
                        client_config.serverURI)
             if not pki_dry_run_flag:
-                self.client = ConfigurationRESTClient(client_config)
+                self.client = ConfigurationClient(client_config)
             return self.client
         except URISyntaxException, e:
             e.printStackTrace()
diff --git a/base/kra/functional/drmclient.py b/base/kra/functional/drmclient.py
index 62940fdf247bb81413dd2b44302acfdd147d5571..ffa6d6367973959b65dc29f3dc32664bdb01ec66 100644
--- a/base/kra/functional/drmclient.py
+++ b/base/kra/functional/drmclient.py
@@ -612,7 +612,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keyrequests/archive',
+            self._request('/kra/agent/keyrequests/archive',
                          self.kra_agent_port,
                          self.POST,
                          etree.tostring(request.getroot(), encoding='UTF-8'))            
@@ -637,7 +637,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/config/cert/transport',
+            self._request('/kra/agent/config/cert/transport',
                          self.kra_agent_port,
                          self.GET,
                          None)            
@@ -675,7 +675,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keys',
+            self._request('/kra/agent/keys',
                           self.kra_agent_port,
                           self.GET,
                           get_args)
@@ -717,7 +717,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keyrequests',
+            self._request('/kra/agent/keyrequests',
                           self.kra_agent_port,
                           self.GET,
                           get_args)
@@ -750,7 +750,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keyrequests/recover',
+            self._request('/kra/agent/keyrequests/recover',
                          self.kra_agent_port,
                          self.POST,
                          etree.tostring(request.getroot(), encoding='UTF-8'))            
@@ -798,7 +798,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keyrequests/approve/'+ request_id,
+            self._request('/kra/agent/keyrequests/approve/'+ request_id,
                          self.kra_agent_port,
                          self.POST,
                          None)            
@@ -820,7 +820,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keyrequests/reject/'+ request_id,
+            self._request('/kra/agent/keyrequests/reject/'+ request_id,
                          self.kra_agent_port,
                          self.POST,
                          None)            
@@ -842,7 +842,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keyrequests/cancel/'+ request_id,
+            self._request('/kra/agent/keyrequests/cancel/'+ request_id,
                          self.kra_agent_port,
                          self.POST,
                          None)            
@@ -898,7 +898,7 @@ class kra:
         
         #Call CMS
         http_status, http_reason_phrase, http_headers, http_body = \
-            self._request('/kra/pki/keys/retrieve',
+            self._request('/kra/agent/keys/retrieve',
                          self.kra_agent_port,
                          self.POST,
                          etree.tostring(request.getroot(), encoding='UTF-8'))            
diff --git a/base/kra/functional/src/com/netscape/cms/servlet/test/DRMRestClient.java b/base/kra/functional/src/com/netscape/cms/servlet/test/DRMClient.java
similarity index 97%
rename from base/kra/functional/src/com/netscape/cms/servlet/test/DRMRestClient.java
rename to base/kra/functional/src/com/netscape/cms/servlet/test/DRMClient.java
index 372b8aea6c7b2bbd2b047bead5344233f7673f00..6be926c4e74a95398ceffa42dc955154e7a21986 100644
--- a/base/kra/functional/src/com/netscape/cms/servlet/test/DRMRestClient.java
+++ b/base/kra/functional/src/com/netscape/cms/servlet/test/DRMClient.java
@@ -23,13 +23,13 @@ import com.netscape.cms.servlet.request.model.KeyRequestInfos;
 import com.netscape.cms.servlet.request.model.RecoveryRequestData;
 import com.netscape.cmsutil.util.Utils;
 
-public class DRMRestClient  extends CMSRestClient {
+public class DRMClient extends CMSRestClient {
 
     private KeyResource keyClient;
     private KeyRequestResource keyRequestClient;
     private SystemCertificateResource systemCertClient;
 
-    public DRMRestClient(ClientConfig config) throws URISyntaxException {
+    public DRMClient(ClientConfig config) throws URISyntaxException {
         super(config);
 
         systemCertClient = createProxy(SystemCertificateResource.class);
diff --git a/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java b/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java
index 62cdfe992014b28eb5f2b871677cdfb63f3ef314..9954ba94f74e708974fc98bb1c4776ac2ed4a80f 100644
--- a/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java
+++ b/base/kra/functional/src/com/netscape/cms/servlet/test/DRMTest.java
@@ -194,13 +194,13 @@ public class DRMTest {
         // Set base URI and get client
 
 
-        DRMRestClient client;
+        DRMClient client;
         try {
             ClientConfig config = new ClientConfig();
             config.setServerURI(protocol + "://" + host + ":" + port + "/kra");
             config.setCertNickname(clientCertNickname);
 
-            client = new DRMRestClient(config);
+            client = new DRMClient(config);
 
         } catch (Exception e) {
             e.printStackTrace();
-- 
1.7.11.2

